Most recent entries from csaf_pepperlfuchsse

VDE-2026-014 — Pepperl+Fuchs: ICE2-* and ICE3-* are affected by multiple security vulnerabilities

Wed, 16 Sep 2026 08:00:00 +0000

The affected devices have security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified schemata can be used to read sensitive information such as password hashes or private keys from the devices.

VDE-2024-017 — Pepperl+Fuchs: ICE2- * and ICE3- * are affected by multiple vulnerabilities

Wed, 10 Apr 2024 06:00:00 +0000

Critical vulnerabilities have been discovered in the product due to outdated software components.The impact of the vulnerabilities on the affected device may result in

Denial of service Bypassing of authentication Information disclosure

VDE-2025-011 — PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability and information disclosure

Mon, 26 May 2025 10:00:00 +0000

A stored cross-site scripting vulnerability has been discovered in the profinet gateway LB8122A.1.EL. An attacker can write an HTML tag with up to 32 characters in the message field of a HART transmitter. The HTML tag is interpreted as HTML when the HART information is displayed in a webbrowser. If the HTML tag contains a link to a manipulated page, a user can be tricked into accessing this page. Furthermore, an attacker can access information about running processes via the SNMP protocol. Sending such SNMP read commands can also trigger a reboot.

VDE-2024-038 — Pepperl+Fuchs: Anonymous FTP server and Telnet access allows information disclosure and manipulation

Wed, 10 Jul 2024 06:00:00 +0000

Critical vulnerabilities has been discovered in the product, mainly caused by ananonymous FTP server and Telnet access.The impact of the vulnerabilities on the affected device may result in

Information disclosure Denial of service Device manipulation

VDE-2025-002 — PEPPERL+FUCHS: HMI – devices are affected by Windows RCE

Tue, 25 Feb 2025 11:00:00 +0000

An unauthenticated attacker could repeatedly send IPv6 packets, that include specially crafted packets, to a Windows machine which could enable remote code execution.

VDE-2022-021 — Pepperl+Fuchs: RSM-EX devices - Multiple Bluetooth vulnerabilities

Mon, 16 May 2022 14:00:00 +0000

Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner's public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue. Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey. Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol) to determine the AuthValue via a brute-force attack (unless the AuthValue is sufficiently random and changed each time). Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment. Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN. Bluetooth LE and BR/EDR secure pairing in Bluet…

VDE-2021-041 — Pepperl+Fuchs: Multiple DTM and VisuNet Software affected by log4net vulnerability

Tue, 26 Oct 2021 13:35:00 +0000

Critical vulnerabilities have been discovered in the utilized component log4net by Apache Software Foundation.

UPDATE A: Remediation: added fixed VisuNet Products

VDE-2020-053 — Pepperl+Fuchs: Comtrol RocketLinx ICRL-M - Multiple Vulnerabilities

Mon, 08 Mar 2021 13:44:00 +0000

Several critical vulnerabilities within firmware.

VDE-2020-017 — Pepperl+Fuchs, PACTware: Two password vulnerabilities found

Fri, 29 May 2020 10:00:00 +0000

PACTware passwords are stored in a recoverable format (CVE-2020-9403)

PACTware passwords may be modified without knowing the current password (CVE-2020-9404)

VDE-2024-033 — PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure…

Tue, 13 Aug 2024 12:00:00 +0000

Vulnerabilities have been discovered in the product, mainly caused by HTML injection and crosssite-scripting. The impact of the vulnerability on the affected device may result in an information disclosure and denial of service.